IN THE CLAIMS 



Please amend the Claims as Follows: 

1. (currently amended) A method of classifying a message transmitted over a network, 
the method comprising: 

maintaining a reputation table in memory, the reputation table including 
information regarding a plurality of address-domain pairs, each of the plurality of 
address-domain pairs [[pair]] indicating an IP address and an associated domain of a 
previously received message, the information regarding each of the plurality of address- 
domain pairs [[pair]] including one or more classification variables, the one or more 
classification variables decaying with time; 

receiving the message transmitted over the network; and 
executing instructions stored in a non-transitory computer readable storage 
medium to: 

determine [[the]] an associated domain from which the received message 
is purported to be sent, 

identify that the determined domain appears on a whitelist, 

determine an IP address corresponding to a device from which the 
received message was relayed, 

associate the determined domain with the IP address to create an 
address-domain pair for the received message; 

classify the received message based on a score assigned to the address- 
domain pair, the score comprising a ratio of a first classification variable of the 
address-domain pair to a second classification variable of the address-domain 
pair as indicated by the reputation table, and 

override the whitelist based on the score assigned to the address-domain 
pair, wherein the received message is classified as spam even though the domain 
of the received message appears on the whitelist. 
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2. (cancelled) 



3. (currently amended) The method of claim 1, wherein classifying the received message 
is further based on classification variables associated with another address-domain pair, 
the other address-domain pair having a related IP address or related domain. 

4. (currently amended) The method of claim 1, wherein classifying the received message 
is further based on classifications of other messages associated with the domain of the 
received message, the other messages further being associated with IP addresses other 
than the IP address of the received message. 

5. (original) The method of claim 1, wherein a plurality of IP addresses is associated 
with the domain. 

6. (original) The method of claim 1, wherein the IP address is associated with a plurality 
of domains. 

7. (original) The method of claim 1, wherein the IP address is a boundary IP address. 

8. (original) The method of claim 1, wherein the IP address is preconfigured. 

9. (original) The method of claim 1, wherein the IP address is preconfigured to be one 
hop from a gateway IP address. 

10. (original) The method of claim 1, wherein the IP address is learned. 

11. (original) The method of claim 1, wherein the IP address is adaptively determined. 

12. (cancelled) 
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13. (previously presented) The method of claim 10, wherein the IP address is a 
boundary IP address and wherein the boundary IP address is learned by detecting a 
pattern in a certain number of previously received messages. 

14. (currently amended) The method of claim 1, wherein determining the domain from 
which the received message is purported to be sent includes identifying the stated 
sender domain associated with the received message. 

15. (previously presented) The method of claim 1, wherein the domain is a domain 
associated with a boundary IP address. 

16. (currently amended) The method of claim 1, wherein classifying the received 
message is further based on consulting a white list. 

17. (currently amended) The method of claim 1, wherein classifying the received 
message is further based on based on previous classifications made to the address- 
domain pair. 

18. (cancelled) 

19. (previously presented) The method of claim 1, wherein assigning the score includes 
determining a spam ratio. 

20. (previously presented) The method of claim 1, wherein assigning the score includes 
determining a spam rate. 

21. (previously presented) The method of claim 1, wherein assigning the score includes 
determining an estimated instantaneous spam rate. 
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22. (cancelled) 



23. (currently amended) The method of claim 1, wherein classifying the received 
message includes giving a classification variable greater weight relative to another 
classification variable. 

24. (currently amended) The method of claim 1, wherein classifying the received 
message includes giving a classification variable associated with user classification 
greater weight relative to a classification variable associated with computer 
classification. 

25. (currently amended) The method of claim 1, wherein classifying the received 
message includes giving an indeterminate classification a fraction of the weight of a 
good classification. 

26. (previously presented) The method of claim 1, wherein the reputation table is 
indexed by IP address and domain. 

27. (previously presented) The method of claim 1, wherein each cell of the reputation 
table includes information about previous classifications. 

28. (currently amended) The method of claim 1, further comprising providing the 
classification of the received message based on the address-domain pair as input to 
another classifier. 

29. (previously presented) The method of claim 28, wherein the other classifier is a 
Bayesian classifier. 
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30. (currently amended) The method of claim 1, wherein classifying the received 
message is further based on a score assigned to the IP address. 

31. (currently amended) The method of claim 1, wherein classifying the received 
message is further based on a score assigned to the domain. 

32. (currently amended) The method of claim 1, further comprising determining that 
the received message was forged based on the score assigned to the domain. 

33. (previously presented) The method of claim 30, further comprising determining the 
score assigned to the IP address. 

34. (previously presented) The method of claim 31, further comprising determining the 
score assigned to the domain. 
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35. (currently amended) A non-transitory computer-readable storage medium having 
embodied thereon a program, the program being executable by a processor to perform a 
method for classifying a message transmitted over a network, the method comprising: 

maintaining a reputation table including information regarding a plurality of 
address domain pairs, each address domain pair indicating an IP address and an 
associated domain of a previously received message, the information regarding each 
address domain pair including one or more classification variables, the one or more 
classification variables decaying with time; 

determining [[the]] an associated domain from which [[the]] a received message 
is purported to be sent; 

identifying that the determined domain appears on a whitelist, 

determining an IP address from which the received message was relayed; 

associating the determined domain with the IP address to create an address- 
domain pair for the received message ; 

classifying the received message based on a score assigned to the address- 
domain pair, the score comprising a ratio of a first classification variable of the address- 
domain pair to a second classification variable of the address-domain pair [[as]] , the first 
classification variable and the second classification variable indicated by [[the]] a 
reputation table including information regarding a plurality of address-domain pairs, 
each of the plurality of address-domain pairs indicating an IP address and an associated 
domain of a previously received message, the information regarding each of the 
plurality of address-domain pairs including one or more classification variables, the one 
or more classification variables decaying with time, and 

overriding the whitelist based on the score assigned to the address-domain pair, 
wherein the received message is classified as spam even though the domain of the 
received message appears on the whitelist. 

36. (cancelled) 
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